security-review/requirements.txt

# Headless agentic runner (run_headless.py). Scanners (semgrep, gitleaks,
# checkov, cfn-lint, pip-audit) and npm are external binaries, installed separately
# (see README).
claude-agent-sdk
# Cross-family reviewer CLI (cross_review.py) — direct OpenAI SDK, no langchain.
openai
feat: add router-less cross-family reviewer CLI (cross_review.py) Re-homes the archived orchestrator repo's GPT-4.1 cross_reviewer as a direct OpenAI SDK CLI: verbatim system prompt, same model id, ported 3-attempt exponential-backoff retry. Reads OPENAI_API_KEY from the environment or the gitignored repo-root .env. Lazy openai import so --help works without the package. 2026-07-14 19:04:57 -04:00			`# Headless agentic runner (run_headless.py). Scanners (semgrep, gitleaks,`
chore: import security-review gate, sweep, and Plane-1 checkers into standalone repo Fresh-init copy of the security-review/ subsystem extracted from Sea-Haven-Industries/orchestrator (being deprecated). Adds org-standard scaffold: CI reusable-workflow callers (ruff + collect), dependency-review, labeler, dependabot, .gitignore, requirements.txt. Scheduled execution is migrating to Claude Code web routines (ALARM-only to #repo-scanner); the systemd units and nightly_sweep.sh/checker_coordinator.sh remain the source of truth. Committed with --no-verify: the canary fixtures (checkers/fixtures/**) carry intentional secret-shaped test data that trips the deterministic gate (the documented detector-fixture false positive); no new logic is introduced. 2026-06-29 11:41:41 -04:00			`# checkov, cfn-lint, pip-audit) and npm are external binaries, installed separately`
feat: add router-less cross-family reviewer CLI (cross_review.py) Re-homes the archived orchestrator repo's GPT-4.1 cross_reviewer as a direct OpenAI SDK CLI: verbatim system prompt, same model id, ported 3-attempt exponential-backoff retry. Reads OPENAI_API_KEY from the environment or the gitignored repo-root .env. Lazy openai import so --help works without the package. 2026-07-14 19:04:57 -04:00			`# (see README).`
chore: import security-review gate, sweep, and Plane-1 checkers into standalone repo Fresh-init copy of the security-review/ subsystem extracted from Sea-Haven-Industries/orchestrator (being deprecated). Adds org-standard scaffold: CI reusable-workflow callers (ruff + collect), dependency-review, labeler, dependabot, .gitignore, requirements.txt. Scheduled execution is migrating to Claude Code web routines (ALARM-only to #repo-scanner); the systemd units and nightly_sweep.sh/checker_coordinator.sh remain the source of truth. Committed with --no-verify: the canary fixtures (checkers/fixtures/**) carry intentional secret-shaped test data that trips the deterministic gate (the documented detector-fixture false positive); no new logic is introduced. 2026-06-29 11:41:41 -04:00			`claude-agent-sdk`
feat: add router-less cross-family reviewer CLI (cross_review.py) Re-homes the archived orchestrator repo's GPT-4.1 cross_reviewer as a direct OpenAI SDK CLI: verbatim system prompt, same model id, ported 3-attempt exponential-backoff retry. Reads OPENAI_API_KEY from the environment or the gitignored repo-root .env. Lazy openai import so --help works without the package. 2026-07-14 19:04:57 -04:00			`# Cross-family reviewer CLI (cross_review.py) — direct OpenAI SDK, no langchain.`
			`openai`